Trifecta Tech Foundation, which develops projects such as ntpd-rs, sudo-rs, zlib-rs, and bzip2-rs, announced the transition of Firefox to using the zlib-rs library for compression and decompression using the gzip method. In addition to protecting against problems caused by memory usage errors, the switch from zlib to zlib-rs has resulted in a noticeable increase in performance — tests showed speed improvements ranging from 3.3 to 32.5 times for individual decoding operations and from 2.7 to 10.86 times for continuous stream decoding.
The zlib-rs library was utilized in the release of Firefox 151, but after its integration, some users experienced a problem leading to crashes due to out-of-bounds errors. It is noted that in Rust code, the issue caused crashes, whereas in C a similar situation would have resulted in undetectable data corruption without stopping the operation. As a solution, the use of the old zlib library was restored in release 151.0.1.
The first manifestation of the problem was noticed during testing of early builds over a year ago, but developers were unable to reproduce it on their systems. Ultimately, after a year of testing among beta release users, it was decided to activate zlib-rs in the Firefox 151 release. After a new series of problem reports and analysis of patterns, it was discovered that the failure was caused by an error in the CPU microcode of Intel's Raptor Lake architecture for the 13th and 14th generations, related to using the wrong register.
The issue arose because the LLVM code generator used the instruction "mov byte ptr [rsi + rdi + 1], ch" when writing the Huffman encoding results to memory. When this instruction was executed on Raptor Lake CPUs, bits 0-7 corresponding to register CL were written to memory instead of 8-15 bits from register RCX, which corresponded to register CH as specified in the instruction. During the preparation for the Firefox 152 release, the error was circumvented, and the patch was incorporated into the main zlib-rs component. The problematic instruction was noted in LLVM 22 (it is not generated in the under-development LLVM 23 branch).
Allikas: opennet.ru
